Skip to content

2.10.1

Choose a tag to compare

View all tags
@csebold csebold released this 01 Apr 06:51
· 2557 commits to main since this release
2.10.1
This tag was signed with the committer’s verified signature.
csebold Charles Sebold
SSH Key Fingerprint: qjgmSGpSpT2WrjJRb0UJWxkAkuiM+UdhL0joFXVY3j0
Verified
Learn about vigilant mode.
09f6ac3

Quilltap v2.10.1 Release Notes

The vault is sealed, the search is plugged in, and the butler didn't do it — the pepper did.

Highlights

Pepper Vault — No more fiddling with environment variables to secure your encryption. A web-based setup wizard auto-generates and stores your encryption pepper on first run, with optional passphrase protection. Existing env var users get a gentle nudge to migrate.

Pluggable Web Search Providers — Web search is now a proper plugin system. Swap search backends without touching code, manage API keys from Settings, and build your own providers with the new SearchProviderPlugin interface. Ships with a bundled Serper.dev plugin out of the box.

Major Features

Pepper Vault — Encryption Key Management

  • Auto-generates ENCRYPTION_MASTER_PEPPER on first run — no manual environment variable needed
  • Web-based setup wizard at /setup with optional passphrase protection
  • Encrypted pepper stored in SQLite pepper_vault table
  • Three startup modes: auto-resolve (no passphrase), unlock (passphrase required), and setup (first run)
  • Existing env var users prompted to store pepper in vault via dismissible banner
  • API routes at /api/v1/system/pepper-vault for status, setup, unlock, and store
  • PepperVaultGate client component redirects to setup when vault is uninitialized
  • Pepper state tracked in startupState with isPepperResolved() gate
  • Authenticated API routes return 503 when pepper is not yet resolved
  • lib/encryption.ts now uses lazy pepper loading (reads from process.env on demand)
  • ENCRYPTION_MASTER_PEPPER is now optional in env schema
  • Comprehensive unit tests for pepper vault lifecycle

Pluggable Web Search Provider System

  • New SEARCH_PROVIDER plugin type for pluggable web search backends
  • New SearchProviderPlugin interface in @quilttap/plugin-types 1.14.0
  • Search provider registry (lib/plugins/search-provider-registry.ts) for managing search provider plugins
  • Bundled Serper.dev search provider plugin (qtap-plugin-search-serper)
  • Web search handler rewritten to use search provider plugins with DB-stored API keys
  • Providers API now returns both LLM and search providers
  • API key test endpoint supports both LLM and search providers
  • SERPER_API_KEY env var deprecated in favor of Settings > API Keys (legacy env var still works as fallback)
  • New docs/SEARCH_PLUGIN_DEVELOPMENT.md guide for building custom search provider plugins

Bug Fixes

  • Removed verbose debug logging from pepper vault and web search handler

Migration Notes

  • Encryption pepper: New installations will be guided through the setup wizard automatically. Existing installations using ENCRYPTION_MASTER_PEPPER in their environment will continue to work — a banner will suggest migrating to the vault for convenience.
  • Serper API key: SERPER_API_KEY as an environment variable still works but is deprecated. Move your key to Settings > API Keys when convenient.
Assets 2
Loading